Skip to main content

js-yaml CVE-2026-84375

| EUVDEUVD-2026-69712 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-09-01 GitHub_M GHSA-2883-xcg3-v3hh
Denial Of Service Js Yaml Nodeca
7.5
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Deliver small crafted YAML document via HTTP
  2. Delivery
    Parser resolves << merge key against aliased empty-mapping array
  3. Exploit
    mergeKeys() iterates O(N×K) sources without incrementing totalMergeKeys counter
  4. Execution
    CPU exhausted for extended duration
  5. Impact
    Service availability degraded or denied

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target application must use js-yaml 3.x before 3.15.2 or 4.x before 4.3.2 and must pass attacker-controlled content to js-yaml.load(), js-yaml.safeLoad(), or equivalent. No authentication, no privileged configuration, and no user interaction beyond delivering the document is required - YAML merge key support is active by default in both affected release lines. Exploitation is limited to services that directly or indirectly parse external YAML input (API bodies, file uploads, configuration imports from untrusted sources). Applications that do not expose YAML parsing to external input, enforce CPU-time limits at the infrastructure level, or use a schema that excludes merge keys are not exploitable.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately models the threat: network-reachable, trivial to construct, unauthenticated, no interaction, availability-only impact. No CVSS/description conflict is apparent. Real-world risk is elevated significantly above what a standalone 7.5 score suggests because: (1) js-yaml is a transitive dependency in a very large fraction of the npm ecosystem, meaning vulnerable versions are present wherever Node.js is deployed; (2) merge key processing is on by default, requiring no non-standard configuration to expose; (3) the attack document needed is small and the reproduction logic is published in the upstream test suite alongside the fix, substantially lowering attacker effort. EPSS data was not provided; KEV status is absent, so active exploitation is not confirmed. The pathological test case embedded in the patch (n = 20000 empty mappings merged into 20000 targets) demonstrates the practical feasibility with a tiny payload.
Exploit ScenarioDerived

An attacker sends a single HTTP POST request to any API endpoint that passes the request body through js-yaml.load() or js-yaml.safeLoad(). The payload is a valid YAML document defining an anchor &arr pointing to a sequence of tens of thousands of empty mappings, then referencing *arr as the << merge source across an equal number of mapping targets. The parser iterates over all empty sources for every target, consuming CPU for several seconds to minutes per request, and repeated requests can saturate server CPU with minimal bandwidth.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 01, 2026

Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's maxTotalMergeKeys safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (<<) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.

RemediationAI

Upgrade js-yaml to version 3.15.2 (for 3.x consumers) or 4.3.2 (for 4.x consumers); both releases are available on npm and confirmed via tagged GitHub releases at https://github.com/nodeca/js-yaml/releases/tag/3.15.2 and https://github.com/nodeca/js-yaml/releases/tag/4.3.2. The patch in PR #797 closes the bypass by charging maxTotalMergeKeys for every merge source, including empty ones, so the existing limit now functions as intended after upgrading. For teams unable to upgrade immediately, two compensating controls exist with trade-offs: (1) Wrap YAML parsing in a CPU-time or wall-clock deadline using Node.js AbortController or a setTimeout-based kill - this caps blast radius but does not prevent the attack and may cause request failures under load; (2) Switch to a schema that does not recognize merge keys (e.g., CORE_SCHEMA in v4 or explicitly passing schema: require('js-yaml').CORE_SCHEMA) - this eliminates the attack surface entirely but will break any YAML documents that legitimately use << merge syntax. Setting maxTotalMergeKeys to a low value on unpatched versions does not provide protection against empty-mapping bypass and should not be relied upon until after upgrading.

Affected VersionsENISA

js-yaml 4.0.0, < 4.3.2
js-yaml 3.0.0, < 3.15.2

Affected Packages

npm js-yaml fix: 3.15.2, 4.3.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

js-yaml (CPE: cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:*:*:*) is the dominant YAML parsing library in the Node.js/npm ecosystem. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and is rooted in the mergeKeys() function inside lib/js-yaml/loader.js (v3) and lib/loader.js (v4). The function incremented the totalMergeKeys counter only when a merge source contributed at least one real key. Empty mappings ({}) contributed zero keys, so they were processed without touching the counter. An attacker exploits YAML aliasing: a large array of empty mappings (&arr [{},{},...]) is defined once, then that alias is used as the << merge source for many targets, causing the parser to iterate over the full array for each target - O(N×K) work - while the safety ceiling is never approached. The published PR #797 and three accompanying commits fix this by introducing a chargeMergeKey() helper that charges one counter unit per merge source processed, regardless of whether that source was empty.

Know when Js Yaml gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Network-delivered YAML parsed without authentication; impact is pure CPU exhaustion with no confidentiality or integrity breach.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Sep 01, 2026 - 23:18 EUVD
CVE Published
Sep 01, 2026 - 21:43 cve.org
HIGH 7.5

DescriptionCVE.org

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.

Technical POC Analysis

The flaw is an inefficient merge-key implementation (CWE-407) that leads to uncontrolled CPU consumption (CWE-400).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Executive ViewAI

Why It Matters

Organizations widely using Node.js for applications and APIs face a critical availability threat from a flaw in js-yaml, one of the npm ecosystem's most popular YAML parsing libraries. Publicly available exploit code exists for this vulnerability, allowing attackers to craft small, seemingly harmless YAML documents that trigger uncontrolled CPU consumption and crash production services. With no patch currently available and the flaw enabled by default across all affected versions (3.0.0-3.15.1 and 4.0.0-4.3.1), remediation requires immediate compensating controls rather than waiting for a vendor fix.

Business Impact: High
Compensating Controls

Implement maximum document size limits (e.g., <100 KB), configure js-yaml's maxMergeKeys parameter to a conservative value (e.g., 10), add request rate limiting on YAML parsing endpoints, deploy WAF rules to detect and block merge-key-heavy payloads, and isolate YAML parsing to resource-constrained containers with CPU/memory quotas. Monitor npm advisory updates and vendor releases; no vendor-released patch identified at time of analysis.

Threat Intelligence Overview

EPSS Score
0.4%
Top 68% exploitable
Prevalence
Ubiquitous
most downloaded YAML parser in the npm ecosystem
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Js Yaml

View all
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2026-59870 HIGH POC
7.5 Jul 08

Denial of service in the js-yaml JavaScript YAML parser (versions 5.0.0 up to but not including 5.2.1) allows remote att
CVE-2026-59869 HIGH POC
7.5 Jul 08

Denial of service in js-yaml (a widely-used JavaScript YAML parser) 3.0.0-3.14.x and 4.0.0-4.2.x allows remote attackers
CVE-2026-59868 HIGH POC
7.5 Jul 08

Denial of service in the js-yaml Node.js YAML parser (versions 5.0.0 up to but not including 5.2.0) lets a remote attack
CVE-2025-64718 MEDIUM
5.3 Nov 13

js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploit

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:62810 ADVISORY https://access.redhat.com/errata/RHSA-2026:62813 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-84375 ADVISORY https://vuldb.com/vuln/397934 REF https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639 REF https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480 REF https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b REF https://github.com/nodeca/js-yaml/pull/797 REF https://github.com/nodeca/js-yaml/releases/tag/3.15.2 REF https://github.com/nodeca/js-yaml/releases/tag/4.3.2 REF https://github.com/nodeca/js-yaml/releases/tag/5.4.1 REF https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy